Log File Monitoring in Azure using Microsoft Operations Manager Insight
- Log File Monitoring using Microsoft Operations Manager Insight is bit tricky. You should have ths knowledge of developing the management pack. But we will help you.
- Inorder to send the data to Operational Insight, you need to reference "Microsoft.IntelligencePacks.Types" MP. You also need to reference "System.ApplicationLog.Library".
The collection rules has 3 parts:
1) A data source reading the log (In example its picking up every single line from it, matching wildcard “*” – but you can use this to filter what in each of your logs is ‘interesting’/worth collecting).
<DataSource ID="LogDS" TypeID="AppLog!System.ApplicationLog.GenericLog.FilteredEventProvider">
<LogFileDirectory>c:\Logs\</LogFileDirectory>
<LogFilePattern>Test*.log</LogFilePattern>
<LogIsUTF8>false</LogIsUTF8>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
<Operator>MatchesWildcard</Operator>
<Pattern>*</Pattern>
</RegExExpression>
</Expression>
</DataSource>
2) A condition detection used to MAP fields to the ‘event’ shape that OpInsights Log Management expects,
<ConditionDetection ID="Mapper" TypeID="SystemLibrary7585010!System.Event.GenericDataMapper">
<EventOriginId>$Target/Id$</EventOriginId>
<PublisherId>$MPElement$</PublisherId>
<PublisherName>GenericLog</PublisherName>
<Channel>$Data/EventData/DataItem/LogFileName$</Channel>
<LoggingComputer>$Target/Property[Type='MicrosoftWindowsLibrary7585010! Microsoft.Windows.Computer']/PrincipalName$</LoggingComputer>
<EventNumber>0</EventNumber>
<EventCategory>3</EventCategory>
<EventLevel>0</EventLevel>
<UserName></UserName>
<Description>$Data/EventData/DataItem/Params/Param[1]$</Description>
<Params />
</ConditionDetection>
3)A write action to send this data to the cloud:
<WriteAction ID="HttpWA" TypeID="IPTypes!Microsoft.SystemCenter.CollectCloudGenericEvent" />
Complete Rule Code:
<Rule ID="MomUIGeneratedRuledc3f1e40e7d54c5a82e408523d686031" Enabled="true" Target="MicrosoftWindowsLibrary7585010!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="LogDS" TypeID="AppLog!System.ApplicationLog.GenericLog.FilteredEventProvider">
<LogFileDirectory>c:\Logs\</LogFileDirectory>
<LogFilePattern>Test*.log</LogFilePattern>
<LogIsUTF8>false</LogIsUTF8>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
<Operator>MatchesWildcard</Operator>
<Pattern>*</Pattern>
</RegExExpression>
</Expression>
</DataSource>
</DataSources>
<ConditionDetection ID="Mapper" TypeID="SystemLibrary7585010!System.Event.GenericDataMapper">
<EventOriginId>$Target/Id$</EventOriginId>
<PublisherId>$MPElement$</PublisherId>
<PublisherName>GenericLog</PublisherName>
<Channel>$Data/EventData/DataItem/LogFileName$</Channel>
<LoggingComputer>$Target/Property[Type='MicrosoftWindowsLibrary7585010!Microsoft.Windows.Computer']/PrincipalName$</LoggingComputer>
<EventNumber>0</EventNumber>
<EventCategory>3</EventCategory>
<EventLevel>0</EventLevel>
<UserName></UserName>
<Description>$Data/EventData/DataItem/Params/Param[1]$</Description>
<Params />
</ConditionDetection>
<WriteActions>
<WriteAction ID="HttpWA" TypeID="IPTypes!Microsoft.SystemCenter.CollectCloudGenericEvent" />
</WriteActions>
</Rule>
